Attacks/Breaches
10/22/2012
04:52 PM
50%
50%

Who Is Hacking U.S. Banks? 8 Facts

Hackers have labeled the bank website disruptions as grassroots-level reprisal for an anti-Islamic film. But is the Iranian government really backing the attacks?
Previous
1 of 8
Next


Who's behind the recent online attacks against U.S. banks? A Muslim hacktivist group calling itself the Cyber fighters of Izz ad-din Al qassam continues to take credit for the campaign of website disruptions. In recent weeks, its distributed denial-of-service (DDoS) attacks, launched under the banner of "Operation Ababil," have disrupted the websites of some of Wall Street's biggest financial institutions, including Bank of America, BB&T, JPMorgan Chase, Capital One, HSBC, New York Stock Exchange, Regions Financial, SunTrust, U.S. Bank, and Wells Fargo.

The hacktivist group's name refers to "Izz ad-Din al-Qassam, a Muslim holy man who fought against European forces and Jewish settlers in the Middle East in the 1920s and 1930s," according to The New York Times. In a similar vein, the website disruptions have been portrayed by some backers as a spontaneous, grassroots-driven online protest. But the actual identity of the attackers, as well as their motives or backing, remain the subject of much debate. Notably, U.S. officials--speaking anonymously in media interviews--have alleged that the group, despite what its own anonymous public pronouncements might claim, is nothing more than a front for an operation that's being run by the Iranian government.

In a series of Pastebin posts, the hacktivists have typically previewed which banks they'll be disrupting, as well as the dates and times of planned attacks. At the same time, they've broadly denied U.S. government officials' assertions, including allegations that the group has been involved in recent attacks that employed malware to obtain credentials for U.S. bank websites, allowing attackers to wire money from U.S. to overseas bank accounts, stealing up to $900,000 in one go.

So, what do the attackers want? According to their Pastebin pronouncements, their goal is relatively simple: they want to see the Innocence of Muslims film that mocks the founder of Islam removed from the Internet. A 14-minute clip of the film first surfaced on YouTube in July 2012, parts of which were broadcast on Egyptian television on Sept. 9, 2012.

The film has been attributed to Nakoula Basseley Nakoula (a.k.a. Mark Basseley Youssef), 55, who was recently arrested in the United States on parole violations, which could see him returned to jail for two years. Nakoula, an Egyptian-born U.S. resident, was on parole after serving prison time for his 2010 conviction on bank fraud charges, and his alleged parole violations include using aliases, using a computer without supervision, and lying to his probation officer. Nakoula, however, has denied all charges against him. He's due back in court next month.

In the meantime, the attacks on banking websites show no signs of stopping.

Image credit: Photograph of Wall Street courtesy of Flickr user Michael Daddino.

Previous
1 of 8
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Leo Regulus
50%
50%
Leo Regulus,
User Rank: Apprentice
10/24/2012 | 4:52:32 PM
re: Who Is Hacking U.S. Banks? 8 Facts
Very disappointed in Editor's choice of article format. This has been extensively discussed in the past.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-6477
Published: 2014-11-23
Unspecified vulnerability in the JPublisher component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality via unknown vectors, a different vulnerability than CVE-2014-4290, CVE-2014-4291, CVE-2014-4292, CVE-2014-4...

CVE-2014-4807
Published: 2014-11-22
Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 9.3.0 before FP8 allows remote authenticated users to cause a denial of service (CPU consumption) via a '\0' character.

CVE-2014-6183
Published: 2014-11-22
IBM Security Network Protection 5.1 before 5.1.0.0 FP13, 5.1.1 before 5.1.1.0 FP8, 5.1.2 before 5.1.2.0 FP9, 5.1.2.1 before FP5, 5.2 before 5.2.0.0 FP5, and 5.3 before 5.3.0.0 FP1 on XGS devices allows remote authenticated users to execute arbitrary commands via unspecified vectors.

CVE-2014-8626
Published: 2014-11-22
Stack-based buffer overflow in the date_from_ISO8601 function in ext/xmlrpc/libxmlrpc/xmlrpc.c in PHP before 5.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by including a timezone field in a date, leading to improper XML-RPC encoding...

CVE-2014-8710
Published: 2014-11-22
The decompress_sigcomp_message function in epan/sigcomp-udvm.c in the SigComp UDVM dissector in Wireshark 1.10.x before 1.10.11 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?